Re: Logwatch-Devel Digest, Vol 36, Issue 7

Maybe that's the reason. I have proftp logging to a separate log file. Or
alternatively maybe this is just an OS issue. I am using fedora linux - does
your proftp log format match solaris' syslog format? Fedora's syslogs are
formatted like proftpd's, more or less.

Anyway - seems like it should be easy enough to make the filter work for
both, I'm happy to give you updates and test in my situation to make this
thing better.

Another addition from last night's log for the "don't care section"

         ( $ThisLine =~ /Preparing to chroot to directory '.*'/ ) or

(happens after a successful login, which is already reported).

Also this for my "unmatched summary" thing, deals with messages not in the
correct format (e.g. daemon startup notification)

      # Report any unmatched entries...
      $UnmatchedEntries++;
      if ($IgnoreUnmatched == 2) {
          ($Host,$IP,$Message) = ($ThisLine =~ /\((.*)\[(.*)\]\): (.*)$/);
          if ($Message == "") {
              $UnmatchedList{$ThisLine}++;
          } else {
            $Temp = "   $Host \[$IP\] : $Message - ";
            $UnmatchedList{$Temp}++;
          }
      } elsif ($IgnoreUnmatched == 0) {
          push @OtherList,$ThisLine . "\n";
      }


-- Jamie

>Not sure about the formats. The logs I have are from a Solaris box 
>proftpd is logging to syslog. The biggest "gotcha" is by default 
>proftpd-messages is looking at "messages" [/var/log/messages or 
>/var/adm/messages] most details are going to /var/log/authlog under
>solaris.
>
>...
>
>So of course mine is :/ less then perfect. I suppose I should add 
>authlog to the conf. [Anyone under linux get a split of logging between 
>messages and secure]
>
>-Mike